A method and device for secure reading and writing of data in Hongmeng system equipment

Abstract

The present invention discloses a data security reading and writing method and device in a Hongmeng system device, and relates to the field of information security. The scheme stores the generated root key and the application identifier in a key library, and stores the encryption key obtained by processing the root key in a key asset library; during the user operation, the encryption key stored in the key asset library is used to encrypt the second type of data, and the encryption and decryption interface is called to encrypt the first type of data, and the encrypted data is stored in a key value database. The present application stores the root key and the encryption key in different databases, the root key is stored in the key library and cannot be exported, the encryption key is stored in the key asset library, different keys are used for encryption and decryption processing according to different user data, and big data is stored in the key value database, which can effectively protect the security of keys and user data in the Hongmeng system and is easy to use.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method and device for securely reading and writing data in a Hongmeng system device. Background Art

[0002] Hongmeng system is used to support various devices, such as smartphones, tablets, smart watches, smart TVs and IoT devices. Hongmeng system connects different devices together through a distributed architecture to achieve resource sharing and information transmission. Users can switch seamlessly on different devices and enjoy a consistent user experience. Hongmeng system also has adaptive capabilities, which can intelligently allocate system resources according to device resources and user needs to provide a smooth and efficient operation experience. As a result, the secure storage of user privacy data is also crucial. Hongmeng system provides an encryption mechanism for trusted execution environment (TEE), which can store the keys used for encryption and decryption operations in TEE, and use the encryption and decryption interface provided by Hongmeng system to encrypt and decrypt data. However, TEE can only write keys and has strict requirements on data length. However, in actual applications, there are many requirements for the storage of big data, and the storage solutions provided by Hongmeng system have restrictions on the length of stored data. Therefore, how to ensure data security and big data storage in Hongmeng system has become an urgent problem to be solved. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a method and device for securely reading and writing data in a Hongmeng system device.

[0004] In a first aspect, an embodiment of the present invention provides a method for securely reading and writing data in a Hongmeng system device, including: writing and reading first type data, writing and reading second type data,

[0005] The writing process of the first type of data includes:

[0006] Step A1: receiving first type of data to be written;

[0007] Step A2: calling the encryption and decryption interface of the key library with the first type of data to be written, the preset algorithm identifier, the root key identifier corresponding to the user identifier of the current user of the system, and the encryption operation identifier as parameters, saving the first type of data ciphertext and the preset key returned by the encryption and decryption interface in the key-value database, and binding the preset key as the user first type of data identifier with the user identifier of the current user of the system;

[0008] The writing process of the second type of data includes:

[0009] Step B1: receiving the second type of data to be written, obtaining the encryption key and encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, performing a digest calculation on the encryption key, and determining whether the calculated digest value is consistent with the obtained encryption key digest value. If yes, executing step B2, otherwise reporting an error;

[0010] Step B2: using the encryption key to encrypt the second type of data to be written according to a preset encryption algorithm, and storing the encrypted data ciphertext and the preset key in the key-value database, and binding the preset key as the user second type data identifier with the user identifier of the current user of the system;

[0011] The process of reading the first type of data includes:

[0012] Step C1: using the user first type data identifier corresponding to the user identifier of the current system user as a key, reading the first type data ciphertext of the current system user from the key-value database;

[0013] Step C2: calling the encryption and decryption interface of the key library with the first type of data ciphertext, the preset algorithm identifier, the root key identifier corresponding to the user identifier of the current user of the system, and the decryption operation identifier as parameters to obtain the first type of data plaintext returned by the encryption and decryption interface;

[0014] The process of reading the second type of data includes:

[0015] Step D1: using the user second type data identifier corresponding to the user identifier of the current user of the system as a key, reading the second type data ciphertext from the key-value database, obtaining the encryption key and encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, performing digest calculation on the encryption key, and judging whether the calculated digest value is consistent with the obtained encryption key digest value, if yes, executing step D2, otherwise reporting an error;

[0016] Step D2: using the encryption key to decrypt the second type of data ciphertext according to a preset algorithm to obtain the second type of data plaintext.

[0017] In a second aspect, an embodiment of the present invention further provides a data security reading and writing device in a Hongmeng system device, including: the first type of data writing module includes:

[0018] The first type data writing module includes:

[0019] A first receiving unit, used for receiving first type data to be written;

[0020] A first writing unit, used to call the encryption and decryption interface of the key library with the first type of data to be written, a preset algorithm identifier, a root key identifier corresponding to the user identifier of the current user of the system, and an encryption operation identifier as parameters, save the first type of data ciphertext and the preset key returned by the encryption and decryption interface in a key-value database, and bind the preset key as the user first type of data identifier to the user identifier of the current user of the system;

[0021] The second type data writing module includes:

[0022] A second writing unit, used for receiving second type data to be written;

[0023] The first judgment unit is used to obtain the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, perform a digest calculation on the encryption key, and judge whether the calculated digest value is consistent with the obtained encryption key digest value, and trigger the second writing unit if yes, otherwise report an error;

[0024] The second writing unit is used to encrypt the second type of data to be written using the encryption key according to a preset encryption algorithm, and store the encrypted data ciphertext and the preset key in the key-value database, and bind the preset key as the user second type data identifier to the user identifier of the current user of the system;

[0025] The first type of data reading module includes:

[0026] A first reading unit, used to read the first type of data ciphertext of the current user of the system from the key-value database by using the user first type data identifier corresponding to the user identifier of the current user of the system as a key;

[0027] A first decryption unit, used to call the encryption and decryption interface in the key library by taking the first type of data ciphertext, a preset algorithm identifier, a root key identifier corresponding to a user identifier of a current user of the system, and a decryption operation identifier as parameters, and obtain the first type of data plaintext returned by the encryption and decryption interface;

[0028] The second type data reading module includes:

[0029] A second reading unit, configured to read the second type of data ciphertext from the key-value database by using the user second type data identifier corresponding to the user identifier of the current user of the system as a key;

[0030] The second judgment unit is used to obtain the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, perform a digest calculation on the encryption key, and judge whether the calculated digest value is consistent with the obtained encryption key digest value, and trigger the second decryption unit if yes, otherwise report an error;

[0031] The second decryption unit is used to use the encryption key to decrypt the second type of data ciphertext according to a preset algorithm to obtain the second type of data plaintext.

[0032] In a third aspect, an embodiment of the present invention further provides an electronic device, characterized in that the electronic device comprises at least one processor, a memory, and instructions stored in the memory and executable by the at least one processor, and the at least one processor executes the instructions to implement any of the methods described above.

[0033] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium includes a computer program, and when the computer program runs on an electronic device, the electronic device executes any one of the methods described above.

[0034] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program / instruction, characterized in that the computer program / instruction is executed by a processor as any of the methods described above.

[0035] Compared with the prior art, the present invention has the following advantages: in this technical solution, a root key that cannot be exported and is stored in a key store (English name: KeyStore) is used to encrypt the first type of data, and an encryption key stored in a key asset store (English name: Asset Store) is used to encrypt the second type of data; the encryption results are all stored in a key-value database, which overcomes the defects of the prior art and can effectively protect the security of keys and user data in the Hongmeng system. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flowchart of a sensitive data writing process in a Hongmeng system provided in Embodiment 2 of the present invention;

[0037] Figure 2 A flowchart of a normal data writing process in a Hongmeng system provided in Embodiment 2 of the present invention;

[0038] Figure 3 A flowchart of a sensitive data reading process in a Hongmeng system provided in Embodiment 2 of the present invention;

[0039] Figure 4A flowchart of a normal data reading process in a Hongmeng system provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0040] This application proposes a method and device for secure reading and writing of data in a Hongmeng system device. The specific implementation method of this application is described in detail below in conjunction with the accompanying drawings. Examples of the embodiments are shown in the accompanying drawings. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and cannot be interpreted as limitations on this application.

[0041] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0042] In order to make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings.

[0043] Embodiment 1

[0044] Embodiment 1 of the present invention provides a method for securely reading and writing data in a Hongmeng system device, including: writing and reading first type data, and writing and reading second type data;

[0045] In this embodiment, the first type of data is sensitive data including user privacy information and key data information, such as user key identifier and user key pair; the second type of data includes ordinary interaction data and ordinary data of user status, such as user name, user status, and business data.

[0046] The writing process of the first type of data includes:

[0047] Step A1: receiving sensitive data to be written;

[0048] Optionally, in this embodiment, between step A1 and step A2, the following steps are further included:

[0049] Step L1: Determine whether there is a corresponding root key in the key library of the current application according to the user ID of the current user of the system. If yes, execute step A2; otherwise, execute step L2;

[0050] Step L2: Call the system key generation interface to generate a root key;

[0051] Specifically, step L2 in this embodiment includes:

[0052] Step L21: Call the first function of the system key generation interface to obtain a key generator instance;

[0053] Step L22: calling the second function of the system key generation interface according to the key generator instance to generate a key object;

[0054] Step L23: calling the third function of the system key generation interface to obtain the binary data of the key object;

[0055] Step L24: Call the fourth function of the system key generation interface according to the binary data of the key object to obtain the root key of the hexadecimal string;

[0056] Step L3: calling the first storage interface of the system to store the root key and the preset root key identifier in the key library, binding the root key identifier with the user identifier of the current user of the system, and executing step A2;

[0057] Optionally, in this embodiment, after step L3, the following steps may further include: generating an encryption key according to the root key, calculating the encryption key to obtain an encryption key summary value, storing the preset encryption key identifier, the encryption key and the encryption key summary value in a key asset library accordingly, and binding the encryption key identifier to the user identifier of the current user of the system;

[0058] Step A2: calling the encryption and decryption interface of the key library with the sensitive data to be written, the preset algorithm identifier, the root key identifier corresponding to the user identifier of the current system user, and the encryption operation identifier as parameters, saving the sensitive data ciphertext and the preset key returned by the encryption and decryption interface in the key-value database, and binding the preset key as the user sensitive data identifier to the user identifier of the current system user;

[0059] In this embodiment, in step A2, the sensitive data ciphertext returned by the encryption and decryption interface and the preset key are saved in the key-value database, specifically: a management object instance of the key-value database is created through a first system creation interface, the key-value database is obtained through a first system acquisition interface according to the management object instance, and the preset key and the sensitive data ciphertext are saved as a key-value pair in the key-value database through a first system method;

[0060] Among them, the system's first creation interface is distributedKVStore.createKVManager, the management object instance is used to manage database objects, specifically KVManager, the system's first acquisition interface is getKVStore, and the system's first method is the put method;

[0061] The process of writing normal data includes:

[0062] Step B1: receiving the common data to be written, obtaining the encryption key and encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, performing digest calculation on the encryption key, and judging whether the calculated digest value is consistent with the obtained encryption key digest value. If yes, executing step B2, otherwise reporting an error;

[0063] Optionally, in this embodiment, before obtaining the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system in step B1, the following steps may be performed:

[0064] Step M1: search the corresponding encryption key and encryption key digest value in the key asset library according to the encryption key identifier bound to the user identifier of the current user of the system. If found, obtain the encryption key and encryption key digest value in the key asset library. If not found, execute step M2;

[0065] Step M2: judging whether there is a corresponding root key in the key library according to the root key identifier bound to the user identifier of the current user of the system, if yes, executing step M3, otherwise reporting an error;

[0066] Step M3: Generate an encryption key based on the root key, calculate the encryption key to obtain an encryption key summary value, and store the encryption key identifier, encryption key, and encryption key summary value bound to the user identifier of the current user of the system in the key asset library accordingly;

[0067] In this embodiment, the step M3 generates the encryption key according to the root key, including: using the initialization session interface of the key library to initialize the key session and obtain the key library handle at the same time, and using the deinitialization interface of the key library with the key library handle and the root key as parameters to end the key session and obtain the encryption key at the same time;

[0068] For example, the initialization session interface is huks.initSession, and the deinitialization interface is huks.finishSession;

[0069] In this embodiment, the encryption key identifier, encryption key, and encryption key summary value bound to the user identifier of the current user of the system in step M3 are correspondingly stored in the key asset library, including: obtaining a key-value pair set of key asset attributes through a first acquisition function of the system, setting the key asset attributes through a first setting method of the system according to the key-value pair set, calling a new key asset interface with the encryption key identifier, encryption key, and encryption key summary value bound to the user identifier of the current user of the system as parameters, and storing the encryption key identifier, encryption key, and encryption key summary value bound to the user identifier of the current user of the system in the key asset library;

[0070] Specifically, the first acquisition function of the system is Map(), the first setting method of the system is the set method, and the new key asset interface of the system is asset.addSync;

[0071] In this embodiment, when using an encryption key to encrypt ordinary data, if there is no encryption key of the current user of the system in the key asset library, the root key of the user stored in the key library can be used to generate an encryption key and stored in the key asset library, which is safe and reliable to use;

[0072] Step B2: using the encryption key to encrypt the common data to be written according to the preset encryption algorithm, and storing the encrypted data ciphertext and the preset key in the key-value database, and binding the preset key as the common data identifier of the user with the user identifier of the current user of the system;

[0073] In this embodiment, the keys and values ​​in the key-value database are stored in a one-to-one correspondence;

[0074] The process of reading sensitive data includes:

[0075] Step C1: using the user sensitive data identifier corresponding to the user identifier of the current user of the system as a key, reading the sensitive data ciphertext of the current user of the system from the key-value database;

[0076] Specifically, in this embodiment, step C1 specifically includes: creating a management object instance of the key-value database through a first creation interface of the system, acquiring the key-value database through a first acquisition interface of the system according to the management object instance, and reading the sensitive data ciphertext of the current user of the system from the key-value database through a second method of the system using the user sensitive data identifier of the current user of the system as a key;

[0077] Among them, the second method is the asset.get method;

[0078] Optionally, between step C1 and step C2 in this embodiment, the following further includes: judging whether there is a root key of the current user of the system in the key library according to the root key identifier corresponding to the user identifier of the current user of the system, if yes, executing step C2, otherwise reporting an error;

[0079] Step C2: calling the encryption and decryption interface in the key library with the sensitive data ciphertext, the preset algorithm identifier, the root key identifier corresponding to the user identifier of the current system user, and the decryption operation identifier as parameters to obtain the sensitive data plaintext returned by the encryption and decryption interface;

[0080] The process of reading normal data includes:

[0081] Step D1: Use the user common data identifier corresponding to the user identifier of the current user of the system as the key, read the common data ciphertext from the key-value database, obtain the encryption key and encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, perform digest calculation on the encryption key, and determine whether the calculated digest value is consistent with the obtained encryption key digest value. If yes, execute step D2, otherwise report an error;

[0082] Optionally, in this embodiment, before obtaining the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system in step D1, the following step may be further performed:

[0083] Step Y1: searching for the encryption key and encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, and if found, obtaining the encryption key and encryption key digest value in the key asset library; if not found, executing step Y2;

[0084] Step Y2: judging whether there is a root key in the key library according to the root key identifier corresponding to the user identifier of the current user of the system, if yes, executing step Y3, otherwise reporting an error;

[0085] Step Y3: Generate an encryption key based on the root key in the key library, calculate the encryption key to obtain an encryption key digest value, and save the encryption key identifier, encryption key and encryption key digest value corresponding to the user identifier of the current user of the system in the key asset library;

[0086] In this embodiment, when using the encryption key to decrypt ordinary data, if the encryption key of the current user of the system is not in the key asset library (the encryption key is lost or damaged), the root key of the user stored in the key library can be used to restore the encryption key and save it in the key asset library, which is safe and reliable to use;

[0087] In this embodiment, the user common data identifier corresponding to the user identifier of the current user of the system is used as the key in the identifier D1, and the implementation process of reading the common data ciphertext from the key-value database is consistent with the process of reading the sensitive data ciphertext in step C1, which will not be repeated here;

[0088] Step D2: Use the encryption key to decrypt the ordinary data ciphertext according to the preset algorithm to obtain the ordinary data plaintext.

[0089] In this technical solution, the generated root key and the root key identifier are stored in the key library in correspondence, and the encryption key obtained by processing the root key is stored in the key asset library; when the user operates the application, the encryption key stored in the key asset library is used to encrypt ordinary data, and the encryption and decryption interface (the encryption and decryption interface is used to use the root key in the key library for encryption or decryption operations) is called to encrypt sensitive data, and the encryption result is stored in the key-value database (English name: KV-Store). This application stores the root key and the encryption key in different databases. The root key is stored in the key library and cannot be exported. The encryption key is stored in the key asset library. Different keys (root keys or encryption keys) are used for encryption and decryption according to different user data (ordinary data or sensitive data), and big data (such as encryption results) are stored in the key-value database, which can effectively protect the security of keys and user data in the Hongmeng system and is easy to use.

[0090] Embodiment 2

[0091] Embodiment 2 of the present invention provides a method for securely reading and writing data in a Hongmeng system device, including the process of writing and reading sensitive data and the process of writing and reading ordinary data during the user's operation of the application. The process of writing sensitive data is as follows: Figure 1 As shown, including:

[0092] Step 101: Receive sensitive data to be written, and determine whether there is a corresponding root key in the key library of the current application according to the user ID of the current user of the system. If yes, execute step 104, otherwise execute step 102;

[0093] Step 102: Call the system key generation interface to generate a root key;

[0094] Optionally, the root key is a symmetric key;

[0095] Specifically, in this embodiment, step 102 includes:

[0096] Step 1021: Call the first function of the system key generation interface to obtain a key generator instance;

[0097] For example, the first function is cryptoFramework.createSymKeyGenerator(), and the key generator instance is symKeyGenerator;

[0098] Step 1022: Generate a key object by calling the second function of the system key generation interface according to the key generator instance;

[0099] For example, the second function is: symKeyGenerator.generateSymKeySync(), and the key object is: promiseSymKey;

[0100] Step 1023: Call the third function of the system key generation interface to obtain binary data of the key object;

[0101] For example, the third function is promiseSymKey.getEncoded(), and the binary data of the key object is encodedKey;

[0102] Step 1024: Call the fourth function of the system key generation interface according to the binary data of the key object to obtain the root key of the hexadecimal string;

[0103] For example, the fourth function is encodedKey.data, and the root key of the hexadecimal string is rootKey=-m_SlCMSQDcddGakbiOK11z3psE8bLJmyodqrt7_HTk;

[0104] Step 103: using the root key and the preset root key identifier as parameters to call the first storage interface of the system to store the root key and the root key identifier in the key library accordingly, and binding the root key identifier with the user identifier of the current user of the system;

[0105] Optionally, in this embodiment, after the root key is generated, an encryption key may be generated according to the root key, that is, after step 103, the following steps are further included: generating an encryption key according to the root key, calculating the encryption key to obtain an encryption key summary value, storing the preset encryption key identifier, the encryption key and the encryption key summary value in the key asset library accordingly, and binding the encryption key identifier to the user identifier of the current user of the system;

[0106] For example, the first storage interface of the system is: huks.importKeyItem;

[0107] Step 104: the encryption and decryption interface in the key library is called with the sensitive data to be written, the preset algorithm identifier, the root key identifier corresponding to the user identifier of the current system user, and the encryption operation identifier as parameters, the sensitive data ciphertext and the preset key returned by the encryption and decryption interface are saved in the key-value database, and the preset key is bound to the user identifier of the current system user as the user sensitive data identifier;

[0108] In this embodiment, the sensitive data ciphertext returned by the encryption and decryption interface and the preset key are stored in the key-value database, specifically: a management object instance of the key-value database is created through a first system creation interface, the key-value database is obtained through a first system acquisition interface according to the management object instance, and the preset key and the sensitive data ciphertext are stored as a key-value pair in the key-value database through a first system method;

[0109] Among them, the system's first creation interface is distributedKVStore.createKVManager, the management object instance used to manage the database object is KVManager, the system's first acquisition interface is getKVStore, and the system's first method is the put method;

[0110] For example, the sensitive data in this embodiment includes the user key identifier (user_key_id) and the user key pair (including the user private key user_prikey and the user public key user_pubkey) in the user registration process;

[0111] The encryption and decryption interfaces of the key library in this embodiment include: the initialization session interface huks.initSession (aesKeyAlias, options) and the deinitialization interface huks.finishSession; when the operation identifier in the input parameter is an encryption operation identifier, the encryption and decryption interface implements the encryption function; when the operation identifier in the input parameter is a decryption operation identifier, the encryption and decryption interface implements the decryption function;

[0112] The method of calling the encryption and decryption interface in the key library with the sensitive data to be written, the preset algorithm identifier, the root key identifier corresponding to the user identifier of the current user of the system, and the encryption operation identifier as parameters specifically includes: using the initialization session interface of the key library to initialize the key session and obtain the key library handle at the same time, using the key library handle, the sensitive data to be written, the preset algorithm identifier, the root key identifier corresponding to the user identifier of the current user of the system, and the encryption operation identifier as parameters to end the key session and obtain the sensitive data ciphertext at the same time;

[0113] For example, the sensitive data to be written is: 307402010104206E824A9CCEE44FB77C515F0573E913AB083A945F770F411FFC4C552773C6268AA00706052B8104000AA144034200041474FAC6963F64313E466D02C7F92828989F349271307E169A23CB9FCBC3AEEB8CCE6C8736F5BA779FAF6354957C8C8FD9A3A56EB757B7D4EB92D9BA0032FEFA;

[0114] The ciphertext of sensitive data is: C9_8UoINXdOjquoJFhh-84f4FkPRxzuMzJ6eXbg8LcOt043p-onbdbFGPnKzhjw01b_lOTmfxTEIqfbykSamorkDZ1ls6jP1_otabcw7gyMhhjNE__wEeuRv4mO5P8K0rUuWx4yD4TnEWmkfzfbqL69Mtpvr wuVLF_-1aZxz9j48Gucsum1NezWK30TXhRicTLpKN6H9MsWym2_VrqlN5FT01JaYVV5ty4wFB3rdCVq2_l RkLa1FQ2QEkR4jPBHR_oIGyt5BN2MZJ8wnC2ezPuGix1sXnQkKswQ4yGIB1dmI9yuDroX1cJPUPbJhm48W;

[0115] like Figure 2 As shown, the writing process of normal data includes:

[0116] Step 201: receiving the common data to be written, searching the key asset library for the corresponding encryption key and encryption key digest value according to the encryption key identifier bound to the user identifier of the current user of the system, and executing step 202 if found, and executing step 203 if not found;

[0117] For example, the common data in this embodiment may be a user name or business data;

[0118] Step 202: Calculate the digest of the encryption key in the key asset library, and determine whether the calculated digest value is consistent with the encryption key digest value in the key asset library. If yes, execute step 205, otherwise, report an error.

[0119] Step 203: judging whether there is a corresponding root key in the key library according to the root key identifier bound to the user identifier of the current user of the system, if yes, executing step 204, otherwise reporting an error;

[0120] Step 204: Generate an encryption key based on the root key, calculate the encryption key to obtain an encryption key summary value, save the encryption key identifier bound to the user identifier of the current user of the system, the encryption key and the encryption key summary value in the key asset library, and execute step 205;

[0121] Specifically, in this embodiment, calculating the encryption key to obtain the root key digest includes: calculating the sha256 hash value of the encryption key to obtain the encryption key digest value;

[0122] In this embodiment, the encryption key is generated according to the root key, including: using the huks.initSession interface of the key library to initialize the key session and obtain the key library handle, and calling the huks.finishSession of the key library with the key library handle and the root key as parameters to end the key session and obtain the encryption key.

[0123] For example, the encryption key generated in this step is: 1234567890abcdefghijklmnopqrstuv;

[0124] The corresponding encryption key summary value is: e013633d3aa6041cad8b04c8c90a2d913ff058cb75684d8c2b95d227b46f2cf1;

[0125] In this embodiment, the encryption key identifier, encryption key and encryption key summary value bound to the user identifier of the current user of the system are stored in the key asset library, including: obtaining a key-value pair set (AssetMap) of key asset attributes through Map(), setting the key asset attributes through the set method according to the key-value pair set, calling asset.addSync with the encryption key identifier, encryption key and encryption key summary value bound to the user identifier of the current user of the system as parameters, and storing the encryption key identifier, encryption key and encryption key summary value in the key asset library;

[0126] Step 205: using the encryption key to encrypt the common data to be written according to the preset encryption algorithm, and storing the encrypted common data ciphertext and the preset key in the key-value database, and binding the preset key as the user common data identifier with the user identifier of the current user of the system;

[0127] In this embodiment, the implementation process of storing the encrypted common data ciphertext and the preset key in the key-value database in step 205 is the same as the process of storing the sensitive data ciphertext and the preset key value returned by the encryption and decryption interface in the key-value database in step 104, and will not be repeated here;

[0128] For example, the common data to be written in this step is: 0123456789;

[0129] The encrypted ordinary data ciphertext is: 3feba0f96415cb62c94aa920e58aba11.

[0130] like Figure 3 As shown in the figure, the process of reading sensitive data includes:

[0131] Step 301: using the user sensitive data identifier corresponding to the user identifier of the current system user as the key, reading the sensitive data ciphertext of the current system user from the key-value database, and judging whether there is a root key of the current system user in the key library according to the root key identifier corresponding to the user identifier of the current system user, if yes, executing step 302, otherwise reporting an error;

[0132] In this embodiment, determining whether there is a root key of the current system user in the key library includes: obtaining a corresponding root key identifier according to the user identifier of the current system user, and determining whether there is a root key of the current system user in the key library according to the root key identifier, and if so, executing step 302, otherwise reporting an error.

[0133] Using the user sensitive data identifier corresponding to the user identifier of the current user of the system as the key, the sensitive data ciphertext of the current user of the system is read from the key-value database, including: creating a KVManager object instance by calling distributedKVStore.createKVManager; obtaining the key-value database through getKVStore according to the KVManager object instance, and using the user sensitive data identifier of the current user of the system as the key to read the sensitive data ciphertext of the current user of the system from the key-value database through the get method.

[0134] For example, the sensitive data ciphertext read is: 3feba0f96415cb62c94aa920e58aba11;

[0135] Step 302: calling the encryption and decryption interface of the key library with the sensitive data ciphertext, the preset algorithm identifier, the root key identifier corresponding to the current system user, and the decryption operation identifier as parameters to obtain the sensitive data plaintext returned by the encryption and decryption interface;

[0136] Specifically, the encryption and decryption interfaces for calling the key library are: huks.initSession(aesKeyAlias,options), huks.finishSession(handle, options);

[0137] For example, the ciphertext data read is: C9_8UoINXdOjquoJFhh-84f4FkPRxzuMzJ6eXbg8LcOt043p-onbdbFGPnKzhjw01b_lOTmfxTEIqfbykSamorkDZ1ls6jP1_otabcw7gyMhhjNE__wEeuRv4mO5P8K0rUuWx4yD4TnEWmkfzfbqL69Mtp vrwuVLF_-1aZxz9j48Gucsum1NezWK30TXhRicTLpKN6H9MsWym2_VrqlN5FT01JaYVV5ty4wFB3rdCVq2_ lRkLa1FQ2QEkR4jPBHR_oIGyt5BN2MZJ8wnC2ezPuGix1sXnQkKswQ4yGIB1dmI9yuDroX1cJPUPbJhm48W;

[0138] The plaintext of the sensitive data is: 307402010104206E824A9CCEE44FB77C515F0573E913AB083A945F770F411FFC4C552773C6268AA00706052B8104000AA144034200041474FAC6963F64313E466D02C7F92828989F349271307E169A23CB9FCBC3AEEB8CCE6C8736F5BA779FAF6354957C8C8FD9A3A56EB757B7D4EB92D9BA0032FEFA.

[0139] like Figure 4 As shown, the normal data reading process includes:

[0140] Step 401: using the user common data identifier corresponding to the user identifier of the current user of the system as a key, reading the common data ciphertext from the key-value database, searching the encryption key and encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, and executing step 402 if found, and executing step 403 if not found;

[0141] Specifically, in this embodiment, the user common data identifier corresponding to the user identifier of the current user of the system is used as a key in step 401 to read the common data ciphertext from the key-value database in the same manner as the sensitive data ciphertext reading in step 301, which will not be described in detail here;

[0142] For example, the encryption key read is: 1234567890abcdefghijklmnopqrstuv;

[0143] The encryption key digest value is: e013633d3aa6041cad8b04c8c90a2d913ff058cb75684d8c2b95d227b46f2cf1;

[0144] Step 402: Calculate the digest of the found encryption key and determine whether the calculated digest value is consistent with the found encryption key digest value. If yes, execute step 405; otherwise, report an error.

[0145] Step 403: judging whether there is a root key in the key library according to the root key identifier corresponding to the user identifier of the current user of the system, if yes, executing step 404, otherwise reporting an error;

[0146] Step 404: Generate an encryption key according to the root key in the key library, calculate the encryption key to obtain an encryption key digest value, save the encryption key identifier, encryption key and encryption key digest value corresponding to the user identifier of the current user of the system in the key asset library, and execute step 405;

[0147] Step 405: using the encryption key to decrypt the read ordinary data ciphertext according to the preset algorithm to obtain the ordinary data plaintext;

[0148] For example, the decrypted plaintext data is: 0123456789.

[0149] In this technical solution, the generated root key and the application identifier are stored in the key library (English name: KeyStore), and the encryption key obtained by processing the root key is stored in the key asset library (English name: AssetStore); when the user operates the application, the encryption key stored in the key asset library is used to encrypt the ordinary data, and the encryption and decryption interface (the encryption and decryption interface is used to use the root key in the key library for encryption or decryption operations) is called to encrypt the sensitive data, and the encryption result is stored in the key value database (English name: KV-Store). This application stores the root key and the encryption key in different databases. The root key is stored in the key library and cannot be exported. The encryption key is stored in the key asset library. Different keys (root key or encryption key) are used for encryption and decryption according to different user data (ordinary data or sensitive data), and big data (such as encryption results) are stored in the key value database, which can effectively protect the security of keys and user data in the Hongmeng system and is easy to use; if the encryption key in the key asset library is lost, it can be restored based on the root key in the key library, which can ensure the safe storage of data.

[0150] The method of this embodiment can be applied to different application scenarios. In the Hongmeng system application, different businesses will correspond to the encryption, decryption, writing and reading processes of data. For example, in the registration business, it is necessary to use the root key (root_key, the corresponding root key identifier is root_key_id) in the key library to encrypt the user key identifier user_key_id and the user key pair user_prikey, user_pubkey and other sensitive data to obtain sensitive data ciphertext. Since the sensitive data ciphertext is large, the sensitive data ciphertext needs to be written and stored in the key-value database; use the encryption key (encryption_key, the corresponding encryption key identifier is encryption_key_id) in the key asset library to encrypt the ordinary business data to obtain the ordinary data ciphertext. Since the ordinary data ciphertext is large, the ordinary data ciphertext needs to be stored in the key-value database. In the authentication business, you first need to read the root key and sensitive data ciphertext in the key-value database, use the root key to decrypt the sensitive data ciphertext to obtain the user key, use the user key to encrypt and decrypt the data in the business processing process or perform signature verification operations; read the encryption key and ordinary data ciphertext in the key-value database, use the encryption key to decrypt the ordinary data ciphertext to obtain ordinary business data, and continue with subsequent operations. The method of this embodiment can ensure the security of user data in the business processing process, and big data can be stored in a specific area to ensure safe and reliable storage and use of data.

[0151] Embodiment 3

[0152] Embodiment 3 of the present invention provides: a first type data writing module, a second type data writing module, a first type data reading module and a second type data reading module;

[0153] The first type of data writing module includes:

[0154] A first receiving unit, used for receiving first type data to be written;

[0155] A first writing unit is used to call the encryption and decryption interface in the key library by taking the first type of data to be written, the preset algorithm identifier, the root key identifier corresponding to the user identifier of the current user of the system, and the encryption operation identifier as parameters, save the first type of data ciphertext and the preset key returned by the encryption and decryption interface in the key-value database, and bind the preset key as the user first type of data identifier to the user identifier of the current user of the system;

[0156] Specifically, the first writing unit in this embodiment saves the first type of data ciphertext returned by the encryption and decryption interface and the preset key in the key-value database, specifically: the first system writing unit creates a management object instance of the key-value database through the first creation interface, obtains the key-value database through the system first acquisition interface according to the management object instance, and saves the preset key and the first type of data ciphertext as a key-value pair in the key-value database through the system first method;

[0157] Optionally, the first type data writing module in this embodiment further includes:

[0158] A third judging unit is used to judge whether there is a corresponding root key in the key library of the current application according to the user identifier of the current user of the system, and if so, trigger the first writing unit, otherwise, trigger the first generating unit;

[0159] A first generating unit, used for calling a system key generating interface to generate a root key;

[0160] Specifically, the first generating unit in this embodiment includes:

[0161] A first generating subunit, used for calling a first function of a system key generating interface to obtain a key generator instance;

[0162] A second generating subunit, used for calling a second function of the system key generating interface according to the key generator instance to generate a key object;

[0163] A third generation subunit, used for calling a third function of the system key generation interface to obtain binary data of the key object;

[0164] The fourth generating subunit is used to call the fourth function of the system key generation interface according to the binary data of the key object to obtain the root key of the hexadecimal character string;

[0165] A first saving and binding unit, used to save the root key and the preset root key identifier in the key library correspondingly by calling the first storage interface of the system, bind the root key identifier with the user identifier of the current user of the system, and trigger the first writing unit;

[0166] The second type of data writing module includes:

[0167] A second writing unit, used for receiving second type data to be written;

[0168] The first judgment unit is used to obtain the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, perform a digest calculation on the encryption key, and judge whether the calculated digest value is consistent with the obtained encryption key digest value. If yes, the second writing unit is triggered, otherwise an error is reported;

[0169] A second writing unit is used to encrypt the second type of data to be written using an encryption key according to a preset encryption algorithm, and store the encrypted data ciphertext and the preset key in a key-value database, and bind the preset key as a user second type of data identifier to a user identifier of a current user of the system;

[0170] Optionally, the second type data writing module in this embodiment further includes:

[0171] A first search unit is used to search for the corresponding encryption key and encryption key digest value in the key asset library according to the encryption key identifier bound to the user identifier of the current user of the system, and trigger the first judgment unit if the encryption key and encryption key digest value are found, and trigger the fourth judgment unit if the encryption key and encryption key digest value are not found;

[0172] A fourth judgment unit is used to judge whether there is a corresponding root key in the key library according to the root key identifier bound to the user identifier of the current user of the system, and trigger the second generation and binding unit if yes, otherwise an error is reported;

[0173] A second generating and binding unit is used to generate an encryption key according to the root key, calculate the encryption key to obtain an encryption key summary value, and store the encryption key identifier, the encryption key, and the encryption key summary value bound to the user identifier of the current user of the system in the key asset library, thereby triggering the second writing unit;

[0174] In this embodiment, the third generation binding unit generates an encryption key according to the root key, specifically: the third generation binding unit uses the initialization session interface of the key library to initialize the key session and obtain the key library handle at the same time, and uses the deinitialization interface of the key library with the key library handle and the root key as parameters to end the key session and obtain the encryption key at the same time;

[0175] The third generation binding unit stores the preset encryption key identifier, encryption key and encryption key summary value in the key asset library, specifically: the third generation binding unit obtains the key-value pair set of the key asset attribute through the system first acquisition function, sets the key asset attribute through the system first setting method according to the key-value pair set, calls the new key asset interface with the encryption key identifier, encryption key and encryption key summary value as parameters, and stores the encryption key identifier, encryption key and encryption key summary value in the key asset library;

[0176] The first type of data reading module includes:

[0177] A first reading unit, used to read the first type of data ciphertext of the current user of the system from the key-value database by using the user first type data identifier corresponding to the user identifier of the current user of the system as a key;

[0178] In this embodiment, the first reading unit is specifically used to create a management object instance of the key-value database through a first creation interface, obtain the key-value database through a first acquisition interface according to the management object instance, and use the user first type data identifier of the current user of the system as a key to read the first type data ciphertext of the current user of the system from the key-value database through a second method;

[0179] A first decryption unit is used to call the encryption and decryption interface in the key library by taking the first type of data ciphertext, a preset algorithm identifier, a root key identifier corresponding to the user identifier of the current user of the system, and a decryption operation identifier as parameters to obtain the first type of data plaintext returned by the encryption and decryption interface;

[0180] Optionally, in this embodiment, the first type data reading module further includes:

[0181] A fifth judgment unit, used for judging whether there is a root key of the current user of the system in the key library according to the root key identifier corresponding to the user identifier of the current user of the system, and triggering the first decryption unit if yes, otherwise reporting an error;

[0182] The second type of data reading module includes:

[0183] A second reading unit, configured to read the second type of data ciphertext from the key-value database by using the user second type data identifier corresponding to the user identifier of the current user of the system as a key;

[0184] The second judgment unit is used to obtain the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, perform a digest calculation on the encryption key, and judge whether the calculated digest value is consistent with the obtained encryption key digest value. If so, the second decryption unit is triggered, otherwise an error is reported;

[0185] A second decryption unit, configured to use the encryption key to decrypt the second type of data ciphertext according to a preset algorithm to obtain the second type of data plaintext;

[0186] Optionally, in this embodiment, the second type data reading module further includes:

[0187] A second search unit is used to search for the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, and if found, obtain the encryption key and the encryption key digest value in the key asset library; if not found, trigger the sixth judgment unit;

[0188] A sixth judgment unit, configured to judge whether there is a root key in the key library according to the root key identifier corresponding to the user identifier of the current user of the system, and trigger the fourth generation and binding unit if yes, otherwise reporting an error;

[0189] The fourth generation binding unit generates an encryption key based on the root key in the key library, calculates the encryption key to obtain an encryption key summary value, saves the encryption key identifier, encryption key and encryption key summary value corresponding to the user identifier of the current user of the system in the key asset library, and triggers the second decryption unit.

[0190] Optionally, an embodiment of the present application also provides an electronic device, which includes at least one processor, a memory, and instructions stored in the memory and executable by at least one processor, and at least one processor executes the instructions to implement the data security reading and writing method in the Hongmeng system device in the above embodiment.

[0191] An embodiment of the present invention provides a computer program product, including a computer program / instructions, wherein the computer program / instructions, when executed by a processor, implements a method for securely reading and writing data in a Hongmeng system device in the above-mentioned embodiment.

[0192] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs. When a computer program is loaded and executed on an electronic device, the process or function described in the embodiment of the present application is generated in whole or in part. The computer program can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a base station, electronic device, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another base station, electronic device, server or data center. The computer-readable storage medium can be any available medium that can be accessed by an electronic device or a data storage device such as a server or data center that contains one or more media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc. In the embodiment of the present application, the electronic device may include the device described above.

[0193] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in a claim. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0194] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for securely reading and writing data in a Hongmeng system device, characterized in that: include: The writing and reading process of the first type of data and the writing and reading process of the second type of data: The writing process of the first type of data includes: Step A1: receiving first type of data to be written; Step A2: calling the encryption and decryption interface of the key library with the first type of data to be written, the preset algorithm identifier, the root key identifier corresponding to the user identifier of the current user of the system, and the encryption operation identifier as parameters, saving the first type of data ciphertext and the preset key returned by the encryption and decryption interface in the key-value database, and binding the preset key as the user first type of data identifier with the user identifier of the current user of the system; The writing process of the second type of data includes: Step B1: receiving the second type of data to be written, obtaining the encryption key and encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, performing a digest calculation on the encryption key, and determining whether the calculated digest value is consistent with the obtained encryption key digest value. If yes, executing step B2, otherwise reporting an error; Step B2: using the encryption key to encrypt the second type of data to be written according to a preset encryption algorithm, and storing the encrypted data ciphertext and the preset key in the key-value database, and binding the preset key as the user second type data identifier with the user identifier of the current user of the system; The process of reading the first type of data includes: Step C1: using the user first type data identifier corresponding to the user identifier of the current system user as a key, reading the first type data ciphertext of the current system user from the key-value database; Step C2: calling the encryption and decryption interface of the key library with the first type of data ciphertext, the preset algorithm identifier, the root key identifier corresponding to the user identifier of the current user of the system, and the decryption operation identifier as parameters to obtain the first type of data plaintext returned by the encryption and decryption interface; The process of reading the second type of data includes: Step D1: using the user second type data identifier corresponding to the user identifier of the current user of the system as a key, reading the second type data ciphertext from the key-value database, obtaining the encryption key and encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, performing digest calculation on the encryption key, and judging whether the calculated digest value is consistent with the obtained encryption key digest value, if yes, executing step D2, otherwise reporting an error; Step D2: using the encryption key to decrypt the second type of data ciphertext according to a preset algorithm to obtain the second type of data plaintext.

2. The data security reading and writing method in the Hongmeng system device as claimed in claim 1 is characterized in that: The step A1 and the step A2 also include: Step L1: Determine whether there is a corresponding root key in the key library of the current application according to the user ID of the current user of the system. If yes, execute step A2; otherwise, execute step L2; Step L2: Call the system key generation interface to generate a root key; Step L3: by calling the first storage interface of the system, the root key and the preset root key identifier are correspondingly stored in the key library, the root key identifier is bound to the user identifier of the current user of the system, and step A2 is executed.

3. The data security reading and writing method in the Hongmeng system device as claimed in claim 2 is characterized in that: The step L2 comprises: Step L21: calling the first function of the system key generation interface to obtain a key generator instance; Step L22: Generate a key object by calling the second function of the system key generation interface according to the key generator instance; Step L23: calling the third function of the system key generation interface to obtain the binary data of the key object; Step L24: Call the fourth function of the system key generation interface according to the binary data of the key object to obtain the root key of the hexadecimal string.

4. The data security reading and writing method in the Hongmeng system device as claimed in claim 2 is characterized in that: The step L3 also includes: generating an encryption key based on the root key, calculating the encryption key to obtain an encryption key summary value, storing the preset encryption key identifier, the encryption key and the encryption key summary value correspondingly in a key asset library, and binding the encryption key identifier with the user identifier of the current user of the system.

5. The data security reading and writing method in the Hongmeng system device as claimed in claim 1 is characterized in that: In the step A2, the first type of data ciphertext returned by the encryption and decryption interface and the preset key are saved in the key-value database by: creating a management object instance of the key-value database through the system first creation interface, obtaining the key-value database through the system first acquisition interface according to the management object instance, and saving the preset key and the first type of data ciphertext as a key-value pair in the key-value database through the system first method.

6. The data security reading and writing method in the Hongmeng system device as claimed in claim 1 is characterized in that: In the step B1, before obtaining the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, the following steps are included: Step M1: searching for the corresponding encryption key and encryption key digest value in the key asset library according to the encryption key identifier bound to the user identifier of the current user of the system, and if found, obtaining the encryption key and encryption key digest value in the key asset library, and if not found, executing step M2; Step M2: judging whether there is a corresponding root key in the key library according to the root key identifier bound to the user identifier of the current user of the system, if yes, executing step M3, otherwise reporting an error; Step M3: Generate an encryption key based on the root key, calculate the encryption key to obtain an encryption key summary value, and store the encryption key identifier bound to the user identifier of the current user of the system, the encryption key and the encryption key summary value in the key asset library accordingly.

7. The data security reading and writing method in the Hongmeng system device as claimed in claim 6 is characterized in that: The step M3 of generating an encryption key based on the root key includes: using the initialization session interface of the key library to initialize the key session and obtain the key library handle at the same time, and using the deinitialization interface of the key library with the key library handle and the root key as parameters to end the key session and obtain the encryption key at the same time.

8. The data security reading and writing method in the Hongmeng system device as claimed in claim 6 is characterized in that: The step M3 of storing the encryption key identifier, the encryption key and the encryption key summary value correspondingly in the key asset library includes: obtaining a key-value pair set of key asset attributes through a system first acquisition function, setting key asset attributes through a system first setting method according to the key-value pair set, and calling a system new key asset interface with the encryption key identifier, the encryption key and the encryption key summary value as parameters to store the encryption key identifier, the encryption key and the encryption key summary value in the key asset library.

9. The data security reading and writing method in the Hongmeng system device as claimed in claim 1 is characterized in that: The step C1 includes: creating a management object instance of the key-value database through a first creation interface of the system, acquiring the key-value database through a first acquisition interface of the system according to the management object instance, and reading the first type of data ciphertext of the current user of the system from the key-value database through a second method of the system using a first type of user data identifier corresponding to the current user of the system as a key.

10. The data security reading and writing method in the Hongmeng system device according to claim 1 is characterized in that: The step C1 and the step C2 also include: judging whether there is a root key of the current user of the system in the key library according to the root key identifier corresponding to the user identifier of the current user of the system, and if so, executing step C2, otherwise reporting an error.

11. The data security reading and writing method in the Hongmeng system device according to claim 1 is characterized in that: Before obtaining the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system in step D1, the following further comprises: Step Y1: searching for the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, and if found, obtaining the encryption key and the encryption key digest value in the key asset library; if not found, executing step Y2; Step Y2: judging whether there is a root key in the key library according to the root key identifier corresponding to the user identifier of the current user of the system, if yes, executing step Y3, otherwise reporting an error; Step Y3: Generate an encryption key based on the root key in the key library, calculate the encryption key to obtain an encryption key summary value, and save the encryption key identifier corresponding to the user identifier of the current user of the system, the encryption key and the encryption key summary value in the key asset library.

12. A data security reading and writing device in a Hongmeng system device, characterized in that: include: A first type data writing module, a second type data writing module, a first type data reading module, and a second type data reading module; The first type data writing module includes: A first receiving unit, used for receiving first type data to be written; A first writing unit, used to call the encryption and decryption interface of the key library with the first type of data to be written, a preset algorithm identifier, a root key identifier corresponding to the user identifier of the current user of the system, and an encryption operation identifier as parameters, save the first type of data ciphertext and the preset key returned by the encryption and decryption interface in a key-value database, and bind the preset key as the user first type of data identifier to the user identifier of the current user of the system; The second type data writing module includes: A second writing unit, used for receiving second type data to be written; The first judgment unit is used to obtain the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, perform a digest calculation on the encryption key, and judge whether the calculated digest value is consistent with the obtained encryption key digest value, and trigger the second writing unit if yes, otherwise report an error; The second writing unit is used to encrypt the second type of data to be written using the encryption key according to a preset encryption algorithm, and store the encrypted data ciphertext and the preset key in the key-value database, and bind the preset key as the user second type data identifier to the user identifier of the current user of the system; The first type of data reading module includes: A first reading unit, used to read the first type of data ciphertext of the current user of the system from the key-value database by using the user first type data identifier corresponding to the user identifier of the current user of the system as a key; A first decryption unit, used to call the encryption and decryption interface in the key library by taking the first type of data ciphertext, a preset algorithm identifier, a root key identifier corresponding to a user identifier of a current user of the system, and a decryption operation identifier as parameters, and obtain the first type of data plaintext returned by the encryption and decryption interface; The second type data reading module includes: A second reading unit, configured to read the second type of data ciphertext from the key-value database by using the user second type data identifier corresponding to the user identifier of the current user of the system as a key; The second judgment unit is used to obtain the encryption key and the encryption key digest value in the key asset library according to the encryption key identifier corresponding to the user identifier of the current user of the system, perform a digest calculation on the encryption key, and judge whether the calculated digest value is consistent with the obtained encryption key digest value, and trigger the second decryption unit if yes, otherwise report an error; The second decryption unit is used to use the encryption key to decrypt the second type of data ciphertext according to a preset algorithm to obtain the second type of data plaintext.

13. An electronic device, characterized in that: The electronic device includes at least one processor, a memory, and instructions stored in the memory and executable by the at least one processor, and the at least one processor executes the instructions to implement the method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises a computer program, and when the computer program is executed on an electronic device, the electronic device is enabled to perform the method according to any one of claims 1 to 11.

15. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 11 is implemented.

Images